Microsoft Fought a Hacked Xbox Account Case With 12 Lawyers, and Lost

A Brazilian court has ordered Microsoft to restore a gamer’s hijacked Xbox account, his entire game library, and pay him roughly $400 in damages. Microsoft’s own support staff had told him to just buy his library again, including Minecraft.

The company fought the case with twelve lawyers and a 300-page filing. It lost anyway. The gamer, who goes by Ordo_Liberal on Reddit, did not pay a cent to sue, because Brazilian consumer law let a public defender take his case for free.

A Locked Xbox Library and a ‘Buy It Again’ Email

Ordo_Liberal’s trouble started in April, when someone broke into his Microsoft account despite two-factor authentication (2FA) being turned on. It is unclear whether his 2FA codes arrived by email or the weaker SMS route.

Microsoft’s support team confirmed the account had been stolen. But the thief had already changed its recovery email and phone number, and the company said that made the account unrecoverable under its own policy.

The only fix Microsoft offered was closing the account for good, which meant buying the whole library over again, including Minecraft. The company has spent the past year pushing users toward passkeys and away from passwords and SMS codes for exactly this kind of risk. That shift came too late to help him.

Twelve Lawyers, One Loss

After Ordo_Liberal brought in a lawyer, Microsoft’s support team in Brazil, where he lives, sent a different message. The first reply had been automated, it said, and the case remained under investigation. He filed suit anyway, in Rio de Janeiro’s state court system, and Microsoft fought back with everything it had. The court sided with him regardless.

Update on my last post “Microsoft deleted my acc and told me to buy my games again”. I sued their asses and won! They have to restore my acc with all my games + pay me 400$USD.

Ordo_Liberal posted a follow-up announcing he had won to r/xbox on July 12, closing out a fight that started three months earlier.

The numbers behind the win are worth laying out on their own:

• $400 in moral damages Microsoft now owes him
• 15 days for Microsoft to restore the account and library before daily fines start piling up
• 12 lawyers and a 300-page filing made up Microsoft’s defense
• $0 spent filing the lawsuit itself

The case is tracked under number 0811207-44.2026.8.19.0002 in the TJRJ court system. Filing it cost Ordo_Liberal nothing beyond a new pair of pants, about $10, because the courthouse would not let him file in shorts.

What Did Ubisoft Get Right That Microsoft Didn’t?

Ubisoft asked for ID verification and restored Ordo_Liberal’s linked account within an hour of his support ticket, after the same thief used his stolen Microsoft login to try hijacking it too. No lawsuit, no automated brush-off, just a document check and a fix.

The gap between the two companies’ handling of nearly identical break-ins is stark enough to lay out side by side.

Microsoft accounts carry more than Xbox purchases. Windows licenses, Microsoft 365 subscriptions, store apps and OneDrive files all sit behind the same login, so a permanent suspension can wipe out several products at once, even for an account with strong security habits already in place.

The Same Auto-Reply Turns Up in a Second Inbox

At least one other Redditor said they had received wording identical to Microsoft’s first, automated response, signed by a support agent with the same name as the one on Ordo_Liberal’s case. A separate hacked-account thread on r/pcgaming describes another user’s identical support runaround, suggesting the dead-end reply is a template, not a one-off mistake.

Two-factor authentication is supposed to prevent exactly this kind of takeover. Attackers have found workarounds anyway.

• Password-spraying stolen credentials at scale, then using OAuth login flows to slip past the second factor entirely
• Exploiting misconfigured Conditional Access policies that never actually enforce multi-factor approval on certain sign-in paths
• Letting a real 2FA prompt succeed, then stealing the session token that results instead of the password itself

Microsoft’s answer has been to push users off passwords altogether. More than 99% of its users now have access to passkeys, which the company calls phishing-resistant, and it points to internal research putting multi-factor authentication’s block rate near 99.9%. That still leaves a gap for accounts, like Ordo_Liberal’s, that were compromised before the switch.

Discs Are Disappearing Right as Accounts Need a Backup Plan

Sony has confirmed that starting in January 2028, new PlayStation games will be sold only in digital form. Xbox looks headed the same way. Microsoft’s next console, reportedly codenamed Project Helix, is still weighing whether to include a disc drive, though the company is said to be testing a feature that would convert old physical discs into digital licenses.

The ruling against Microsoft became public just as Sony reaffirmed its all-digital PlayStation shift, putting extra weight on three words buried in most storefronts’ terms of service.

• Revocable license – what most digital game purchases legally amount to. The platform can pull access under its own terms at any time, and the buyer never holds a transferable copy the way a disc owner does.

Metal Gear and Death Stranding director Hideo Kojima called the shift “frightening” at a film festival panel in Italy. Sony’s own history backs him up: the company has already lost distribution rights to more than 500 StudioCanal titles on one of its services, proof that a digital catalog can shrink without warning to the people who paid for access.

The backlash has been loud. A Change.org petition asking Sony to reconsider has gathered close to 180,000 signatures since the announcement went up.

A Playbook That Doesn’t Scale Past Brazil

Reaction on Reddit split between celebration and envy. “The judge really just looked at big tech and said, ‘Pay up and give the account back,’” one commenter wrote. “Brazil just takes its consumer laws more seriously than the US,” another added.

Ordo_Liberal got his library back because he had a free path to court and the patience to use it. Most players are simply trusting that a support ticket will work when it matters, the way it did at Ubisoft and did not at Microsoft.

Sony’s shift to all-digital PlayStation games begins in January 2028. Microsoft has not said when, or whether, Project Helix will ship without a disc drive at all.

Frequently Asked Questions

What is Xbox Project Helix, and will it ship without a disc drive?

Project Helix is Microsoft’s internal codename for its next-generation Xbox console, with alpha devkits reportedly going out to developers in 2027 and a consumer launch targeted for late 2027 or 2028. Microsoft has not confirmed a final name or disc decision; leaks describe an internal disc-to-digital feature that would let owners convert physical discs they already own into digital licenses.

Will PlayStation games bought on disc before 2028 still work?

Yes. Sony’s policy only affects new titles released after January 2028; games already sold on disc, and the discs already sitting in players’ collections, are unaffected. The change applies solely to future releases, which will ship in digital form only.

What should you do if your Xbox or Microsoft account gets hijacked?

Switch to a passkey instead of a password and SMS code, since stolen or intercepted passwords are behind most successful takeovers Microsoft has tracked. Keep a written record of every support ticket and its reference number; that paperwork became the evidence that mattered once lawyers got involved in Ordo_Liberal’s case. Where local consumer protection law allows it, a formal complaint or small-claims filing can carry more weight than another support ticket.

How common is Microsoft account hacking right now?

Very. Cybersecurity firm Huntress tracked a campaign between June 12 and 26, 2026, that compromised 78 Microsoft accounts across 64 organizations, and separate monitoring logged roughly 81 million login attempts against Microsoft 365 accounts using stolen credentials. Microsoft was also the most impersonated brand in phishing attempts during the first quarter of 2026, accounting for 22% of all brand impersonation attempts tracked.

Has Microsoft responded to the Brazilian court ruling?

Not publicly. As of this writing, Microsoft has not issued any statement addressing the verdict, though the compliance clock is already running under the court’s order.